feat!: 2.0 CLI grammar normalization — positional NAME, universal containers, flag unification (#248)

[cdot65]

Summary

Breaking 2.0 release. One grammar across all ~380 commands, enforced by a conformance test suite. No deprecation aliases (approved).

Migration table (old → new)

Old	New
scm set object address --folder X --name web1 --ip-netmask ...	scm set object address web1 --folder X --ip-netmask ...
scm show object service --folder X --list	scm show object service --folder X (list is default; --list removed)
scm show ... --name web1	scm show ... web1
folder-only types (address, service, zone, nat-rule, +13 more)	all accept --folder | --snippet | --device (exactly one, validated)
--tag a,b (CSV: service, service-group, nat-rule, bandwidth-allocation)	--tags a --tags b (repeatable)
layer3-subinterface --tag <vlan>	--vlan-tag <vlan>
scm operations status --job-id X / -j	scm operations status --id X
insights --mock	SCM_MOCK=1 env
load region/tag/schedule/quarantined-device/ike-crypto-profile (no dry-run)	--dry-run on every load
sase backups (no options)	--file on every backup
—	--max-results N on every show

Changes

• sdk_client.py: 48 methods gained snippet/device container support (gen-2 pattern)
• All 7 config modules + operations/insights migrated; dead flags removed; validators gained shared exactly-one container enforcement (ContainerModel, SecurityRule/Zone/etc. no longer hard-require folder)
• tests/test_grammar_conformance.py: 20 introspection tests locking the grammar (positional NAME, container trio, --dry-run/--file/--tags/--output/--max-results, flag bans)
• Version 2.0.0 + major changeset
• Docs fully synced: 42 objects/network pages, 52 other docs-site pages (several documented-but-fictional flags/commands corrected against live --help), README + CLAUDE.md + AGENTS.md (~35 examples, 18 live-verified)

Testing

• 1381 passed, 29 skipped (65 new: conformance suite, container enforcement, --max-results, snippet e2e per module, dry-run tripwires)
• lint/ruff/mypy clean; strict docs build passes
• E2E in mock mode: positional grammar, snippet container, exactly-one violations exit 1, --max-results slicing

Checklist

• Tests written first (conformance suite = Red before migration)
• All tests passing
• Lint/format/typecheck clean
• Documentation updated
• Changeset added (major)
• Version bumped to 2.0.0

Closes #248

🤖 Generated with Claude Code

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[github-actions]

Failed to generate code suggestions for PR